{"basis":"claimed","id":"CVE-2023-5561","name":"WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure","vendorProject":"WordPress","product":"WordPress","publishedAt":"2023-10-16","cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"exploited":null,"epss":{"score":0.04335,"percentile":0.91201,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-08-04","daysToRule":658},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure","description":"WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack","cwes":[],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-08-04","firstIsNew":true,"daysToRule":658,"daysAtMost":null,"freePlan":false,"claims":[{"id":"89a86294bbb83a3fa280dfbc5c02fb68906686a7a39c035ebd961af4e1195365","cve_id":"CVE-2023-5561","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"bba3d37891a440fb8bc95b970cbd9abc","rule_name":"WordPress - Information Disclosure - CVE:CVE-2023-5561","change":"new","default_action":"Block","published_on":"2025-08-04","source_url":"https://developers.cloudflare.com/changelog/post/2025-08-04-waf-release/","source_title":"WAF Release - 2025-08-04","excerpt":"WordPress - Information Disclosure - CVE:CVE-2023-5561. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.350Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:15:26.211Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2023-5561","templatePath":"http/cves/2023/CVE-2023-5561.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/wp-json/wp/v2/users?…","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2023-5561","templatePath":"http/cves/2023/CVE-2023-5561.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/wp-json/wp/v2/users?…","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}